divious1
8.7 KiB
Response Schema Schema
https://raw.githubusercontent.com/splunk/security_content/develop/docs/spec/response_tasks.spec.json
schema for response task
| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Access Restrictions | Defined In |
|---|---|---|---|---|---|---|---|
| Can be instantiated | No | Unknown status | No | Forbidden | Allowed | none | response_tasks.spec.json |
Response Schema Type
object (Response Schema)
Response Schema Default Value
The default value is:
{}
Response Schema Properties
| Property | Type | Required | Nullable | Defined by |
|---|---|---|---|---|
| author | string |
Required | cannot be null | Response Schema |
| date | string |
Required | cannot be null | Response Schema |
| description | string |
Required | cannot be null | Response Schema |
| id | string |
Required | cannot be null | Response Schema |
| name | string |
Required | cannot be null | Response Schema |
| sla | integer |
Optional | cannot be null | Response Schema |
| sla_type | string |
Optional | cannot be null | Response Schema |
| automation | object |
Optional | cannot be null | Response Schema |
| tags | object |
Required | cannot be null | Response Schema |
| version | integer |
Required | cannot be null | Response Schema |
| references | array |
Optional | cannot be null | Response Schema |
| Additional Properties | Any | Optional | can be null |
author
Author of the response task
author
-
is required
-
Type:
string -
cannot be null
-
defined in: Response Schema
author Type
string
author Examples
ButterCup, Splunk
date
date of creation or modification, format yyyy-mm-dd
date
-
is required
-
Type:
string -
cannot be null
-
defined in: Response Schema
date Type
string
date Examples
'2019-12-06'
description
Description of response task
description
-
is required
-
Type:
string -
cannot be null
-
defined in: Response Schema
description Type
string
description Examples
Response example.
id
UUID as unique identifier
id
-
is required
-
Type:
string -
cannot be null
-
defined in: Response Schema
id Type
string
id Examples
fb4c31b0-13e8-4155-8aa5-24de4b8d6717
name
Name of response task
name
-
is required
-
Type:
string -
cannot be null
-
defined in: Response Schema
name Type
string
name Examples
Response Example
sla
Measured integer for Service Level Agreement for completion of the phase
sla
-
is optional
-
Type:
integer -
cannot be null
-
defined in: Response Schema
sla Type
integer
sla Examples
5
30
sla_type
Duration for measured integer for Service Level Agreement for completion of the phase (e.g. minutes, or hours, etc)
sla_type
-
is optional
-
Type:
string -
cannot be null
-
defined in: Response Schema
sla_type Type
string
sla_type Default Value
The default value is:
"minutes"
sla_type Examples
minutes
hours
days
automation
An array of key value pairs for defining actions and playbooks
automation
-
is optional
-
Type:
object(Details) -
cannot be null
-
defined in: Response Schema
automation Type
object (Details)
automation Constraints
minimum number of items: the minimum number of items for this array is: 1
unique items: all items in this array must be unique. Duplicates are not allowed.
automation Default Value
The default value is:
{
"is_note_required": false,
"sla_type": "minutes",
"sla": "",
"role": "",
"action": [],
"playbooks": []
}
automation Examples
is_note_required: false
sla_type: minutes
sla: 30
action:
- run_query
playbooks:
- scm: local
playbook: automate something
- scm: local
playbook: automate something else
tags
An array of key value pairs for tagging
tags
-
is required
-
Type:
object(Details) -
cannot be null
-
defined in: Response Schema
tags Type
object (Details)
tags Constraints
minimum number of items: the minimum number of items for this array is: 1
unique items: all items in this array must be unique. Duplicates are not allowed.
tags Default Value
The default value is:
{}
tags Examples
analytic_story: credential_dumping
version
version of detection, e.g. 1 or 2 ...
version
-
is required
-
Type:
integer -
cannot be null
-
defined in: Response Schema
version Type
integer
version Examples
1
references
A list of references for this response, phase or task (e.g. web or printed citation)
references
-
is optional
-
Type:
string[](Blue Team Handbook by Don Murdoch - Amazon) -
cannot be null
-
defined in: Response Schema
references Type
string[] (Blue Team Handbook by Don Murdoch - Amazon)
references Default Value
The default value is:
[]
references Examples
- Blue Team Handbook by Don Murdoch - Alarm Triage Overview pages 146-148
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
Additional Properties
Additional properties are allowed and do not have to follow a specific schema